in reply to Re: Re: setuid script returning Insecure dependency
in thread setuid script returning Insecure dependency

When faced with a strange problem like this, it helps to strip as much out as possible, to try to get to a small example that demonstrates the problem.

Here's the example I came up with:

#/usr/bin/perl -T $insecure = $ARGV[0]; eval makeformat($insecure); write; sub makeformat { my($name) = @_; # note: $name is tainted return "format = \n" . "\@<<<<\n" . '$' . $name . "\n" . ".\n" # the returned format string is tainted }
The implication is that you're constructing one of your format strings using a variable (or variables) that are still tainted.